Most people have some understanding that shady websites can give you malware, a drive-by exploit is pretty rare but it's good that most people think just visiting a site could infect your computer. But a PDF is just a document, right? Just thinking that a PDF is just words on a page is exactly why it's such an insidious threat. Or they'll get a PDF as an email attachment, see that it's not an exe or something weird, and open it because they think a document is safe.